The "HA" trigger detects whether the following HA events occur:

• HA_SWITCH (Event log ID = 11004101)

• HA_SYNC (Event log ID = 11004102)

• HA_MEMBER (Event log ID = 11004103)

• HA_REBOOT (Event log ID = 11004104)

• HA_RESTORE_CONF (Event log ID = 11004105)

• HA_RESTORE_IMG (Event log ID = 11004106)

• HA_UPDATE (Event log ID = 11004107)

• HA_MONITOR_PORT (Event log ID = 11004108)

The "High CPU" trigger detects whether the CPU usage of FortiWeb is higher than the value specified in Log&Report > Log Config > Other Log Settings > CPU Utilization.

Refer to Use case: Real-time incident alerts for an example of the High CPU use case.

The Local Certificate is used to encrypt the HTTPS connections between:

• Your users and FortiWeb;

• FortiWeb and the back-end servers;

• The admin users and FortiWeb's GUI

If the certificate expires, users will see a certificate invalid warning.

To avoid such warning messages displayed to users, you can use a "Local Certificate Expired" trigger to detect whether the certificates you have uploaded on the following pages are about to expire then update them in time:

• The CA tab on Server Objects > Certificates> CA.

• The Local tab on Server Objects > Certificates> Local.

• The Admin Cert Local tab on System > Admin > Certificates.

FortiWeb by default doesn't log the SSL certificate expire event. Therefore, to use this trigger, you need to run the following command to set the notification time (the days) to a value other than 0 (0 means disabled), so FortiWeb will send notification on the specified day before the certificate expires.

config system global

set cert-expire-check-time <integer>

end

Refer to Use case: Expired SSL certificate management for an example of the use case.

The "License Expired" trigger detects whether the FortiWeb license expires.

Please note that if the network of FortiWeb is disconnected over 48 hours, it will also trigger the "License Expired" event.

Refer to Example: Notification Message for the "License Expired" trigger for the suggested message to be sent when "License Expired" trigger occurs.

This trigger detects whether FortiGuard Database (FDS DB) Update occurs. The FortiGuard Database provides up-to-date threat intelligence.

When an FDS DB update occurs, go to the Signature Update Management tab on System > Config > FortiGuard. The newly added or updated signatures are listed there and are set to alert mode by default. Test the signatures first to ensure they don't trigger false positives or block legitimate traffic. Once deemed safe, select the signature and click Approve.

Refer toUse case: Automated response to FortiGuard Database (FDS DB) updates for an example of the use case.

Use this trigger to initiate the automation action when system prints certain even logs or attack logs.

Refer to the following use cases.

• Use case: Automatic IP banning

• Use case: Blocking repeated attacks from an IP address

• Use case: Automating exception handling for false positives